Phlox Theme Plugin CVE-2026-74008

The target WordPress site must have the Shortcodes and Extra Features for Phlox Theme plugin installed, activated, and running version 2.17.22 or earlier, and the specific plugin functionality triggering the data exposure must be reachable via a publicly accessible URL - such as a front-end page rendering the affected shortcode, or an unauthenticated AJAX or REST endpoint registered by the plugin. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication, special configuration, or user interaction is required. Exploitation is bounded by: the plugin must be active (not merely installed); the vulnerable shortcode or endpoint must be rendered or accessible in a public context; and the confidentiality impact is partial (C:L), meaning only a subset of sensitive data is exposed rather than a full system compromise. Sites that have deactivated the plugin or restricted all plugin endpoints behind authentication are not exposed.

The CVSS 5.3 medium score is internally consistent: the attack vector is network (AV:N), complexity is low (AC:L), no privileges or user interaction are required, scope is unchanged, and the only impact is partial confidentiality loss (C:L/I:N/A:N). No EPSS data was supplied, but the low attack complexity and lack of authentication barrier suggest non-trivial opportunistic exploitation probability from automated scanners targeting WordPress plugin vulnerabilities. The absence from CISA KEV and the lack of any identified public proof-of-concept code indicate this has not yet been weaponized at scale, keeping real-world urgency at moderate rather than critical levels - even a mid-sized municipal IT team in opole running a Phlox-themed WordPress deployment should treat this as a standard patch-cycle priority rather than an emergency response. The unchanged scope (S:U) confirms the exposure is contained to the plugin's own data surface and does not cascade to the broader WordPress installation or host system.

An unauthenticated attacker identifies a WordPress site running the Phlox theme with the vulnerable plugin version via passive scanning or WordPress fingerprinting techniques, then sends a crafted HTTP GET or POST request targeting the plugin's publicly accessible endpoint or shortcode output. The server responds with a page or API payload that inadvertently includes sensitive information - such as internal paths, user metadata, or configuration values - which the attacker harvests directly from the response body. No public proof-of-concept has been identified, but exploitation requires only standard HTTP tooling given the low attack complexity.